TerminalInstance._createProcess() - Local RCE via extensions.json recommendation link

VS Code - Terminal Workspace Trust Bypass Vulnerability

A command execution vulnerability exists in VS Code 1.132.0 and earlier versions where a malicious restricted workspace can execute a terminal task when the user clicks a crafted notification link, even after canceling the trust prompt.

An attacker could exploit these issues by convincing a user to open a malicious workspace in VS Code.

Patches

The fix will be available starting with VS Code 1.132.1. The fix (https://github.com/microsoft/vscode/commit/3154a68fc151bcafe371f89d197412645e6a7616) mitigates these issues by stopping terminal process creation immediately when either security check rejects the launch.

Workarounds

Do not open untrusted workspaces. If an untrusted workspace is already open, do not launch an integrated terminal.

References

• The patch for this can be found at https://github.com/microsoft/vscode/commit/3154a68fc151bcafe371f89d197412645e6a7616
• MSRC incident details can be found at https://portal.microsofticm.com/imp/v5/incidents/details/31000000619797/summary
• MSRC details for these issues can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58650